Description
Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer in Advantech WebAccess before 8.1 allows remote attackers to write to files of arbitrary types via unspecified vectors.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Advantech WebAccess Dashboard Viewer uploadImageCommon Arbitrary File Upload
exploit/windows/scada/advantech_webaccess_dashboard_file_upload
Exploit-DB 1
- Advantech Webaccess Dashboard Viewer - Arbitrary File Upload (Metasploit) EDB-39735 · remote · Apr 26, 2016 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- ICSA-16-014-01 Advantech WebAccess Vulnerabilities CISA ICS & IT advisories · Jun 9, 2025
References
- 39735 exploit
- http://www.zerodayinitiative.com/advisories/ZDI-16-127
- https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01
- http://www.zerodayinitiative.com/advisories/ZDI-16-128
- http://www.rapid7.com/db/modules/exploit/windows/scada/advantech_webaccess_dashboard_file_upload
- http://www.zerodayinitiative.com/advisories/ZDI-16-129